Management VLAN and Service VLAN Recommendations

Direct forwarding

100

50

Recommended standard configuration.

Yes

1

100

Management VLAN tags are added to user service packets, causing service disorder.

No

100

1

Network congestion may occur due to the large broadcast domain of VLAN 1 and broadcast flooding, affecting user experience.

No

1

1

Network congestion may occur due to the large broadcast domain of VLAN 1 and broadcast flooding, affecting user experience.

No

100

100

Data is incorrectly forwarded.

Prohibited

Tunnel forwarding

100

50

Recommended standard configuration.

Yes

1

100

Network congestion may occur due to the large broadcast domain of VLAN 1 and broadcast flooding, affecting user experience.

No

100

1

Network congestion may occur due to the large broadcast domain of VLAN 1 and broadcast flooding, affecting user experience.

No

1

1

Broadcast and multicast packets of wireless services are still forwarded to the wired interfaces on APs, which may affect AP performance.

No

100

100

Broadcast and multicast packets of wireless services are still forwarded to the wired interfaces on APs, which may affect AP performance.

No

The service and management VLANs are different, and neither of them is 1.

Optimal standard configuration.

Recommended

The service and management VLANs are different, and the service VLAN ID is 1.

In direct forwarding mode, the service VLAN ID is 1. User packets are tagged with the service VLAN ID 1 by an AP. Due to particularity of VLAN 1, VLAN ID 1 is removed from the packets by default when they are sent out from an AP, an AC, or a switch.

In this way, service packets sent out from the AP carry no service VLAN ID. When the packets reach the access switch, the access switch adds the management VLAN ID 100 to the packets. Therefore, service packets are tagged with the management VLAN ID, which does not conform to VLAN planning. As a result, some problems may be caused, for example:

• STAs obtain IP addresses from the management VLAN address pool, causing user service disorder, for example, user ACLs do not take effect.
• Portal authentication pages fail to be pushed after Portal authentication is configured.

Not recommended. To perform such configuration, analyze the networking and services.

The service and management VLANs are different, and the management VLAN ID is 1.

Network congestion may occur due to the large broadcast domain of VLAN 1 and broadcast flooding, affecting user experience.

Not recommended

The service and management VLANs are both VLAN 1.

Network congestion may occur due to the large broadcast domain of VLAN 1 and broadcast flooding, affecting user experience.

Not recommended

The service and management VLANs are the same but not 1.

For example, service VLAN 100 and management VLAN 100.

Management packets sent out from APs do not carry VLAN IDs, while service packets carry the service VLAN ID 100. When management packets reach the access switch, the access switch adds the PVID 100 to the packets. The access switch transparently transmits service packets without processing their VLAN IDs. Downlink service packets of users carry the VLAN ID 100. When these packets are sent out from switch interfaces, the service VLAN ID is considered as the management VLAN ID and removed. When the service packets reach an AP, they are considered as management packets and discarded by the AP. As a result, services are interrupted.

Prohibited.

The service and management VLANs are different, and neither of them is 1.

Optimal standard configuration.

Yes

The service and management VLANs are different, and the service VLAN ID is 1.

Network congestion may occur due to the large broadcast domain of VLAN 1 and broadcast flooding, affecting user experience.

No

The service and management VLANs are different, and the management VLAN ID is 1.

Network congestion may occur due to the large broadcast domain of VLAN 1 and broadcast flooding, affecting user experience.

No

The service and management VLANs are both VLAN 1.

Uplink direction: STA -> AP -> AC -> upper-layer network. Assume that a STA sends a broadcast packet in VLAN 1. This packet is encapsulated with a CAPWAP header by the AP and reaches the AC carrying the management VLAN ID 1. After decapsulating the CAPWAP packet, the AC finds that it is a broadcast packet (carrying service VLAN ID 1) sent by the STA, and broadcasts it. One copy of the packet will be sent back to the AC and then to the AP. In this way, which may cause user service interruption.

No

The service and management VLANs are the same but not 1.

For example, service VLAN 100 and management VLAN 100.

In the simple networking with a STA, an AP, and an AC, the AC with the IP address of 10.1.1.1 and MAC address of AAAA-BBBB-CCCC serves as the user gateway. The AP's IP address is 10.1.1.2, and its management VLAN is VLAN 100. The STA's IP address is 10.1.1.254, and its service VLAN is VLAN 100.

A service packet is forwarded from the upper-layer network to the STA as follows: upper-layer network -> AC -> access switch -> AP -> STA. The inner Layer 2 header of the packet is as follows:

Layer 2 header: Source MAC address: AAAA-BBBB-CCCC(VLAN100) //This VLAN is the service VLAN.

In tunnel forwarding mode, a packet sent to the STA is encapsulated with an outer CAPWAP header on the AC. The outer CAPWAP header is as follows:

Layer 2 header: Source MAC address: AAAA-BBBB-CCCC(VLAN100) //This VLAN is the management VLAN.

When this packet reaches the AP through the wired interface, the inner Layer 2 header is invisible for the AP. The AP can only detect the outer CAPWAP header and then a physical interface on the AP learns the AC's MAC address AAAA-BBBB-CCCC. The MAC address table is as follows:

-------------------------------------------------------
MAC Address    VLAN/VSI        Learned-From    Type
-------------------------------------------------------
AAAA-BBBB-CCCC  100/-          GE0/0/0           dynamic
-------------------------------------------------------

For a packet carrying the CAPWAP header sent to the STA, the AP decapsulates the packet to expose the inner Layer 2 header. The CAPWAP tunnel interface on the AP learns the AC's MAC address AAAA-BBBB-CCCC again. The MAC address table is as follows:

-------------------------------------------------------
MAC Address    VLAN/VSI        Learned-From    Type
-------------------------------------------------------
AAAA-BBBB-CCCC  100/-          CAPWAP            dynamic
-------------------------------------------------------

In this way, the AC's MAC address learned by the AP maps two outbound interfaces GE0/0/0 and CAPWAP, causing packet forwarding disorder and service exceptions.

No